CVE-2024-45412: fallo de gravedad media en yeti-platform yeti
Yeti affected by a Potential Denial of Service due to the One Milion Unicode characters attack
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.3epss 0.8%
Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Remote user-controlled data tags can reach a Unicode normalization with a compatibility form NFKD. Under Windows, such normalization is costly in resources and may lead to denial of service with attacks such as One Million Unicode payload. This can get worse with the use of special Unicode characters like U+2100 (℀), or U+2105 (℅) which could lead the payload size to be tripled. Versions prior to 2.1.11 are affected by this vulnerability. The patch is included in 2.1.11.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Productos afectados
yeti-platform · yetiCVEs relacionadas — yeti-platform yeti
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-92783HIGHYeti through 2.11.0 Missing Authorization on RBAC Relationship DeletionEPSS 0.5%CVE-2026-63482HIGHYeti: Unauthenticated Access to Full Audit Timeline Discloses All Threat Intelligence DataEPSS 0.4%CVE-2026-63502HIGHYeti: Path traversal in ExportTask name allows authenticated arbitrary file read and writeEPSS 0.4%CVE-2026-63500HIGHYeti: Path traversal in DFIQ uuid allows authenticated arbitrary file write during archive exportEPSS 0.4%CVE-2026-63489HIGHYeti: Authenticated AQL injection via unvalidated search sorting and filter_aliases parametersEPSS 0.3%